dnstap(8)

🌸 dnstap(8) 🌸 — System Manager's Manual, bestie

okay so this is the manual page for dnstap, and the vibe check is: capture, display, and relay Dnstap data. no cap. 💅

---

✨ NAME ✨

dnstap — capture, display, and relay Dnstap data. periodt. 👑

✨ SYNOPSIS ✨

dnstap [ -u socket-path [ -u socket2-path ... ] ]
       [ -l host:port [ -l host2:port2 ... ] ]
       [ -r file [ -r file2 ... ] ]
       [ -U socket-path [ -U socket2-path ... ] ]
       [ -T host:port [ -T host2:port2 ... ] ]
       [ -w file ] [ -q | -y | -j ] [-a]
       [ -t timeout ]

✨ DESCRIPTION ✨

So dnstap reads data in the Dnstap export format from Frame Streams files, or it receives data on Frame Streams connections to TCP/IP or unix domain socket addresses. Then it can display that data in compact text (the default), JSON, or YAML formats. It can also save data to a file in display or Frame Streams binary format, or relay the data to other Dnstap processes over unix domain socket or TCP/IP connections. it's giving versatile icon. 🦋

✨ OPTIONS ✨

okay bestie, every flag is here — no skips, no “I’ll read it later” energy. 🫶

• -a — when you’re opening a file with -w for text format output (-j, -q, or -y), this appends to the file instead of truncating it. But heads up: -a does not apply when writing binary Frame Streams data to a file. 💅
• -j — writes data in JSON format. Encapsulated DNS messages get rendered in text form similar to the output of dig(1). At most one text format (-j, -q, or -y) option may be given — pick one, bestie. ✨
• -l host:port — listen for Dnstap data on TCP/IP port port on address host. You can give -l multiple times to listen on multiple addresses. At least one input (-l, -r, or -u) option must be given. 👑
• -q — write or display data in compact (quiet) text format. At most one text format (-j, -q, or -y) option may be given — one format only, no cap. 🎀
• -r file — read Dnstap data from the given file. The -r option may be given multiple times to read from multiple files. At least one input (-l, -r, or -u) option must be given. 🍓
• -T host:port — relay Dnstap data over a TCP/IP connection to host:port. dnstap will establish or re-establish this connection as needed. The -T option may be given multiple times to relay Dnstap data to multiple addresses. 🔥
• -t timeout — apply i/o timeout to TCP/IP and unix domain socket connections. timeout is given as a number followed by a unit abbreviation (e.g., ms for milliseconds, s for seconds, m for minutes). ⏳
• -u socket-path — listen for Dnstap data on the unix domain socket at socket-path. dnstap will remove any file or socket at that socket-path before listening. The -u option may be given multiple times to listen on multiple socket paths. At least one input (-l, -r, or -u) option must be given. 🧚
• -U socket-path — relay Dnstap data over a unix domain socket connection to socket-path. dnstap will establish or re-establish this connection as needed. The -U option may be given multiple times to relay Dnstap data to multiple socket paths. 🌈
• -w file — write Dnstap data to file. If file is "-" or no -w, -T, or -U output options are present, data will be written to standard output in quiet text format (-q), unless the YAML or JSON format is specified with the -y or -j options, respectively. If file is a filename other than "-", Dnstap data is written to the named file in Frame Streams binary format by default, unless quiet text, JSON, or YAML formats are specified. dnstap will reopen file on SIGHUP, for file rotation purposes. 🌀
• -y — write Dnstap output in YAML format. Encapsulated DNS messages are rendered in text form similar to the output of dig(1). At most one text format (-j, -q, or -y) option may be given — one format only, bestie. 🌸

✨ EXAMPLES ✨

🎀 Example 1: local name server, quiet text on stdout 🎀

Listen for Dnstap data from a local name server and print quiet text format to standard output.

dnstap -u /var/named/dnstap.sock

🦋 Example 2: local listen, binary save, TCP relay 🦋

Listen for Dnstap data from a local name server, save a local binary copy, and relay it to a remote host over TCP.

dnstap -u /usr/local/unbound/dnstap.sock -w dnstap.fstrm \
     -T dns-admin.example.com:5353

✨ SEE ALSO ✨

dig(1) — that’s the one. iykyk. 💜

Footer sign-off, bestie: dnstap(8) from the System Manager's Manual — that’s the source vibe, and no separate date or version is printed in this copy, so I’m not inventing one. 💖